In modern computer systems, computers may communicate with each other and with other computing equipment over various types of data networks. Routable data networks are configured to route data packets (or frames) from a source network node to one or more destination network nodes. As used herein, the term “routable protocol” refers to a communications protocol that contains a network address as well as a device address, allowing data to be routed from one network to another. Examples of routable protocols are SNA, OSI, TCP/IP, XNS, IPX, AppleTalk, and DECnet. A “routable network” is a network in which communications are conducted in accordance with a routable protocol. One example of a routable network is the Internet, in which data packets are routed in accordance with the Internet Protocol (IP). In a routable data network, when a network routing device (or router) receives a data packet, the device examines the data packet in order to determine how the data packet should be forwarded, if at all. Similar forwarding decisions are made as necessary at one or more intermediate routing devices until the data packet reaches a desired destination node.
Network infrastructure services have been developed for monitoring, managing and manipulating traffic through a network. In general, network infrastructure services may be classified as security services (e.g., firewall, proxy and intrusion detection services), quality of service services (e.g., load balancing), or network management services (e.g., application level management and active network management services). These services conventionally are implemented as one or more software modules executing on general-purpose computers, in hardware, firmware or software operating in single-function (or dedicated) devices, or in software or firmware operating on switches and routers. A general-purpose computer typically provides a complete operating environment for network infrastructure applications, including all of the services provided by the operating system and application program interfaces for communicating with the operating system. New network infrastructure applications may be loaded and, generally, existing network infrastructure applications may be updated on a general-purpose computer simply by loading the new application or application update. However, the performance (e.g., bandwidth, latency, interrupt response time, and processing speed) of general-purpose computers typically is not optimized for running network infrastructure applications. In contrast, the performance of a dedicated device typically is optimized for providing a particular network infrastructure service. Although the operating characteristics of a dedicated device generally may be changed simply by loading a new configuration file into a dedicated device, the service functionality of a dedicated device typically cannot be changed. Thus, a new dedicated device usually is needed for each new network infrastructure service that is to be implemented in the network.
In sum, in terms of network infrastructure service management, general-purpose computers provide the greatest flexibility and the lowest performance, whereas dedicated devices typically provide the highest performance and the least flexibility. The flexibility and performance characteristics of routers and switches generally fall somewhere between the corresponding characteristics of general-purpose computers and dedicated devices.
To address some of these issues, U.S. Pat. No. 6,157,955 has proposed a general-purpose programmable packet-processing platform for accelerating network infrastructure applications that have been structured to separate the stages of classification and action. According to the Abstract of this patent:                Network packet classification, execution of actions upon those packets, management of buffer flow, encryption services, and management of Network Interface Controllers are accelerated by a multiplicity of specialized modules. A language interface is defined for specifying both stateless and stateful classification of packets and to associate actions with classification results in order to efficiently utilize these specialized modules.        